NESTA Crime Online - University of Brighton Repository

2.1.1 Mapping the cybercrime value chain
Most cybercrime attacks of credit card and identity fraud share the need to go
through three basic activities: detecting vulnerabilities, infection and
distribution, and exploitation.
Cybercrime has moved away from the fragmented activities of a few isolated
programmers and is increasingly mimicking corporate business. The fraudsters seem to
have defined roles and specialities and a clear division of labour. This applies to
everything from ATM skimming to phishing and hacking. The actors involved in these
crimes have specific means of communications, rules of engagement and even ethics.
They coordinate their actions to gain competitive advantage – over the system they are
attacking rather than from rival groups, given that the gains are so plentiful – and target
a specific segment of the market.
Each of these activities is intended to support the undetected generation of financial
profit. Therefore, each activity can be associated with multiple methods of achieving a
financial reward (or business models as explained below), with their own sources of
competitive advantage and associated gains or value added, combining with each other
to form a value chain. Cybercrime can thus be seen as a whole value chain facilitating
fraud, with different operations, profit margins, technological capabilities and innovation
opportunities attached to each stage.
Cybercrime attacks resulting in identity theft and credit card fraud generally share the
need to go through three basic activities. Various actors can perform these actions,
either collectively or individually. The increasing trend towards specialisation is rapidly
differentiating the tasks, which has improved the efficiency of each activity and
subsequently the efficiency of the whole industry. The cybercrime value chain is
represented in figure 8.
Page 42